[ppml] Policy Proposal 2007-14 - Staff Assessment

ARIN staff spoke with the author of this proposal here at the ARIN XX
meeting. As a result of that conversation, we will be posting a revised
staff assessment. We will remove staff comments 2, 4 and 6 in the
revised assessment.

Respectfully submitted,

Member Services
American Registry for Internet Numbers (ARIN)


Member Services wrote:
> Policy Proposal 2007-14
> Resource Review Process
> 
> ARIN Staff Assessment
> 
> The assessment of this proposal includes comments from ARIN staff and
> the ARIN General Counsel. It contains analysis of procedural, legal, and
> resource concerns regarding the implementation of this policy proposal
> as it is currently stated. Any changes to the language of the proposal
> may necessitate further analysis by staff and Counsel.
> 
> I. Proposal
> 
> Policy Proposal is available as Annex A below and at:
> http://www.arin.net/policy/proposals/2007_14.html
> 
> II. Understanding of the proposal
> 
> This policy proposal provides clear policy authority to audit or reclaim
> resources, guidelines for how it shall be done, and a guarantee of a
> (minimum) six-month grace period so that the current user shall have
> time to stop using any resources to be reclaimed.
> 
> 
> III. Comments
> 
>    A. ARIN Staff
> 
> 1) 2c does not reconcile with the RSA, which grants ARIN authority to
> request any data necessary and does not specify any sort of limitation
> to frequency.
> 
> 2) Point 4 refers to “ARIN delegation”. Does this include legacy
> registrations or is it only ARIN issued resources?
> 
> 3) Point 3 requires ARIN notify an organization each time a review is
> conducted.  ARIN interprets a review to mean a full audit of an
> organization's resources conducted by ARIN staff.
> 
> 4) Points 4 and 5 use the term “compliance”. ARIN interprets this as
> bringing the organization into compliance with current policy.
> 
> 5) Point 4 uses the terms “single aggregate block”.and “whole
> resources”.  Are these terms used synonymously to refer to a single CIDR
> prefix, or to “a contiguous range of addresses”?
> 
> 6) Point 6 sets the minimum hold time at 6 months.  Current staff
> procedure is a minimum of one year.
> 
> 7) Point 6 compels ARIN to take action which doesn’t reconcile with the
> RSA, which (as articulated above) allows ARIN to take whatever action is
> necessary.
> 
> 8) Author did not indicate placement in the NRPM. We would insert as
> "Section 12 Resource Review Process."
> 
>    B. ARIN General Counsel
> "Counsel strongly supports some version of this policy being enacted and
> believes adoption of this policy will save significant future legal
> fees. This policy proposal spells out a series of customary and
> contractual policies and rights that are important to make as clear as
> possible.
> 
> Counsel does not agree with that portion of the description which states
> ARIN "feels that current policy does not give them the power...." And
> believes such powers are adequately vested in ARIN' but believes instead
> such powers can always be more carefully delineated for ease of
> understanding."
> 
> IV. Resource Impact –  Minimal
> 
> The resource impact of implementing this policy is viewed as minimal.
> Barring any unforeseen resource requirements, this policy could be
> implemented within 30 – 90 days from the date of the ratification of the
> policy by the ARIN Board of Trustees. Depending on the impact to RSD
> this may require additional staff. It will require the following:
> 
> Guidelines Changes
> Registration System Changes
> Staff training
> May increase RSD workload
> May increase turnaround times
> 
> 
> Respectfully submitted,
> 
> Member Services
> American Registry for Internet Numbers (ARIN)
> 
> 
> ##*##
> 
> 
> Annex A
> 
> Policy Proposal 2007-14
> Resource Review Process
> 
> Author: Owen DeLong, Stephen Sprunk
> 
> Proposal type: modify
> 
> Policy term: permanent
> 
> Policy statement:
> 
> Add the following to the NRPM:
> 
> Resource Review
> 
> 1. ARIN may review the current usage of any resources issued by ARIN to
> an organization. The organization shall furnish whatever records are
> necessary to perform this review.
> 
> 2. ARIN may conduct such reviews:
> 
>      a. when any new resource is requested,
>      b. whenever ARIN has cause to believe that the resources had
> originally been obtained fraudulently, or
>      c. at any other time without cause unless a prior review has been
> completed in the preceding 12 months.
> 
> 3. ARIN shall communicate the results of the review to the organization.
> 
> 4. If the review shows that existing usage is substantially not in
> compliance with current allocation and/or assignment policies, the
> organization shall return resources as needed to bring them
> substantially into compliance. If possible, only whole resources shall
> be returned. Partial address blocks shall be returned in such a way that
> the portion retained will comprise a single aggregate block.
> 
> 5. If the organization does not voluntarily return resources as
> required, ARIN may revoke any resources issued by ARIN as required to
> bring the organization into overall compliance. ARIN shall follow the
> same guidelines for revocation that are required for voluntary return in
> the previous paragraph.
> 
> 6. Except in cases of fraud, an organization shall be given a minimum of
> six months to effect a return. ARIN shall negotiate a longer term with
> the organization if ARIN believes the organization is working in good
> faith to substantially restore compliance and has a valid need for
> additional time to renumber out of the affected blocks.
> 
> 7. Legacy resources in active use, regardless of utilization, are not
> subject to revocation by ARIN. However, the utilization of legacy
> resources shall be considered during a review to assess overall compliance.
> 
> Delete NRPM sections 4.1.2, 4.1.3, 4.1.4
> 
> Remove the sentence "In extreme cases, existing allocations may be
> affected." from NRPM section 4.2.3.1.
> 
> Rationale:
> 
> ARIN feels that current policy does not give them the power to review or
> reclaim resources except in cases of fraud, despite this being mentioned
> in the Registration Services Agreement. This policy proposal provides
> clear policy authority to do so, guidelines for how and under what
> conditions it shall be done, and a guarantee of a (minimum) six-month
> grace period so that the current user shall have time to renumber out of
> any resources to be reclaimed.
> 
> The nature of the "review" is to be of the same form as is currently
> done when an organization requests new resources, i.e. the documentation
> required and standards should be the same.
> 
> The renumbering period does not affect any "hold" period that ARIN may
> apply after return or revocation of resources is complete.
> 
> The deleted sections/text would be redundant with the adoption of this
> proposal.
> 
> Timetable for implementation: Immediate
> 
> 
> _______________________________________________
> PPML
> You are receiving this message because you are subscribed to the ARIN Public Policy
> Mailing List (PPML at arin.net).
> Unsubscribe or manage your mailing list subscription at:
> http://lists.arin.net/mailman/listinfo/ppml Please contact the ARIN Member Services
> Help Desk at info at arin.net if you experience any issues.
>